Scammers Use Download Bombs To Freeze Chrome Browsers on Shady Sites (bleepingcomputer.com)

An anonymous reader shares a report: The operators of some tech support scam websites have found a new trick to block visitors on their shady sites and scare non-technical users into paying for unneeded software or servicing fees. The trick relies on using JavaScript code loaded on these malicious pages to initiate thousands of file download operations that quickly take up the user's memory resources, freezing Chrome on the scammer's site. The trick is meant to drive panicked users into calling one of the tech support phone numbers shown on the screen. According to Jerome Segura -- Malwarebytes leading expert in tech support scam operations, malvertising, and exploit kits -- this new trick utilizes the JavaScript Blob method and the window.navigator.msSaveOrOpenBlob function to achieve the "download bomb" that freezes Chrome.

Comments

Who's to blame?

[mrbester]

An immediate concern is why a method with a Microsoft specific vendor prefix is implemented and targetable in Chrome in the first place.

TFA doesn't mention anything about IE/Edge being affected. If it is that would be understandable. They might not have checked, but there is also no reference to any other OS than Windows. Does that mean that msSaveOrOpenBlob is only implemented on the Windows version of Chrome and if so, why?

Re:Who's to blame?

[AvitarX]

On Apple it causes a hang warning with an option to force close, doing so kills only the tab in question.

On all platforms?

[140Mandak262Jamuna]

Wouldn't renice 32 -p $pid fix it for linux/unix?

msSaveOrOpen on Chrome?

[Anonymous Coward]

The ms prefix is a clue that it is Microsoft-only

navigator.msSaveOrOpen doesn't exist for either Chrome or Firefox

Nice try, no cigar.

Re:msSaveOrOpen on Chrome?

[TFlan91]

I was coming here to say just this.

Only in IE do you use navigator.msSaveOrOpenBlob

In Chrome / FF / Safari, you use FileReader.

So this sentence:

"this new trick utilizes the JavaScript Blob method and the window.navigator.msSaveOrOpenBlob function to achieve the "download bomb" that freezes Chrome"

Straight PR move to cast shade on Chrome

Re:msSaveOrOpen on Chrome?

[thegarbz]

So was it a fake recording in the article showing Chrome?

Maybe Chrome should depreciate it.

Re:Javascript in the browser *is* the malware

[Anonymous Coward]

Says someone weeks after Meltdown was demonstrated... running as Javascript in a browser.

Way to go!.

This should be say to fix on the client side

[mark-t]

When a download is initiated by javascript, the browser should pop up a simple dialogue (non modal, but otherwise an "on top" window so they can continue to otherwise use the browser) to confirm the download with a yes/no. Permit only one of these dialogue windows at a time. Other threads wanting to pop up the dialogue can be suspended until the current dialogue is dismissed Threads requesting a download can be handled on a first come first serve.basis.

Re:This should be say to fix on the client side

[TFlan91]

Chrome actually does do this.

When I use JS to initiate multiple downloads, Chrome detects this, stops it, and asks me to continue.

This article is really about IE.

Re:This should be say to fix on the client side

[duke_cheetah2003]

When a download is initiated by javascript, the browser should pop up a simple dialogue (non modal, but otherwise an "on top" window so they can continue to otherwise use the browser) to confirm the download with a yes/no. Permit only one of these dialogue windows at a time. Other threads wanting to pop up the dialogue can be suspended until the current dialogue is dismissed Threads requesting a download can be handled on a first come first serve.basis.

A thousand times: NO!

Been there, done that, you implement something like that, you end up having to click NO a jagillion times to dismiss all the queued up downloads. Stupid.

Re:This should be say to fix on the client side

[Anonymous Coward]

No, it's about Chrome. The example in the article is Chrome. It is entirely possible that the vulnerability comes from Chrome trying to re-interpret an old MS specific HTML instruction, but it is a Chrome issue.

Re:This should be say to fix on the client side

[mark-t]

No, you don't.

As I said, the dialogue is not modal, so there is nothing stopping you from closing the offending page when one of these pops up without necessarily closing the entire browser. Before the dialog even opens, the thread that is opening the dialog can interrogate the client to see if the web page that spawned it is even still active. If it is, then it proceeds, but if not, then it aborts without even showing the dialog at all. Only one of these would ever be shown at one time, so you don't get a bajllion of them at once... they would be responded to on a first-come-first-serve basis. As soon as you dismiss such a dialog after having closed the offending tab or otherwise changed the web page that was loaded in that window, since the web page that was making the js request is closed, all of the other requests that may have been wanting to initiate a download and were suspended, waiting to show the dialog could be silently aborted.

This is honestly entirely trivial to implement in software. The code to manage it in any modern high level language could *EASILY* fit into less than a single printed page.

Re:Not surprising

[wbr1]

Chromium is open... what are you blathering about?

window.navigator.msSaveOrOpenBlob

[zifn4b]

Only works on Microsoft browsers. I don't see a problem here.

Re:window.navigator.msSaveOrOpenBlob

[thegarbz]

Only works on Microsoft browsers. I don't see a problem here.

And yet the screenshot shows it running on Chrome. I have no doubt that Microsoft is at fault or that Microsoft browsers are affected, but clearly it seems to work on Chrome just fine.

Re:window.navigator.msSaveOrOpenBlob

[zifn4b]

You're not a developer probably so you don't understand the difference. Try reading this. Not sure you will get it though but good luck.

Re:window.navigator.msSaveOrOpenBlob

[thegarbz]

You're not good at arguing so you probably don't understand the difference. But your post doesn't invalidate the original point which is that the exploit is shown working in Chrome.

Have you tried turning it off and on again?

[VeryFluffyBunny]

Hard-code this into web browsers' error messages.

Re:Not surprising

[HiThere]

Well, Chrome is not Chromium, but my guess is what he meant was that MSWindows has one application grab the entire screen, the way Gnome3 does. (I think I heard that Gnome3 copied that atrocious idea from MSWindows).

Re:Javascript in the browser *is* the malware

[Chris Mattern]

The text only web is dead grandpa

Only because people have repeatedly shown that they must have the pretty shinies, even if it completely compromises their security. And then they wonder why security is shit.

Re:this is why run adblock in the past flashloaded

[taustin]

I disagree. Some people make far more sense when they're incoherent.

Just try foxnews.com on your phone

[Applehu Akbar]

After a few seconds of viewing the headlines, a scammy popup ad will dominate the screen and prevent you from clicking on any link on the site.

Re:Not surprising

[wbr1]

Windows does not allow one app to grab the focus and hold it without malicious trickery. The only thing that could is kernel level processes like UAC prompts. This has been the case for a long time.

Of course an app can have modal windows within itself for UI reasons - this is perfectly normap

In this case because chrome (and other apps) cannot legally lock the system UI, they do it by thrashing disk IO (which certainly has a large effect on memory and CPU utilization too), effectively freezing the system. IE a malicious workaround.

My point about chromium is that if the GP was lamenting chrome not being open source and vetted, he is wrong - most of it can be. The major differences between chromium and chrome are the pdf viewer, and some proprietary media codecs that are closed and built into chrome. While I do not agree with some of what google does, Chrome is not malware and is probably the best browser out there.

Re:Not surprising

[HiThere]

Actually, saying "it's the best browser" assumes a particular use case. I've tried Chromium, etc., and for my use case Firefox is still the best browser I've encountered, with Konqueror a distant second. This is even after the GUI changes that they've made in the last few years. (OTOH, I'm currently using version 52.6, and it's quite possible that they've made changes that would change my mind.)

But those are the only two browsers I've encountered that let me set up and nicely display a folder of nested folders of bookmarks while browsing. This is one of my "mandatory features". Some other browsers let me have a nicely displayed folder of bookmarks, but the part about nested folders is quite valuable to me.